DVSA & Traffic Commissioner Audit Readiness (UK)

Builds DVSA/Traffic Commissioner “show me” audit readiness checklists and evidence indexes. USE WHEN preparing for audits or operator licence scrutiny.

Security Scan

The skill is an instruction-only template pack for preparing DVSA/Traffic Commissioner audit checklists and evidence indexes; its requirements and runtime instructions are consistent with that purpose and do not request unrelated credentials or installs.

Purpose & Capability

Name, description, and included template assets align: the skill produces a 'today' checklist, evidence index, and gaps register for DVSA/TC audit readiness. There are no unexpected dependencies, binaries, or credentials requested that would be unrelated to this stated purpose.

Instruction Scope

SKILL.md instructions stay within scope: they ask the agent to gather audit context from the user, use supplied templates, and request internal SOPs only when needed. The instructions explicitly warn not to invent legal duties and to stop/ask for missing scope. They do not instruct reading system config, secret env vars, or posting to external endpoints.

Install Mechanism

No install spec and no code files beyond markdown templates — minimal risk. Nothing is downloaded or written by an installer during skill setup.

Credentials

The skill requests no environment variables or credentials. It optionally asks the user to paste internal SOPs/policies, which is reasonable for producing compliance artefacts but could expose sensitive business data if pasted — this is a user-controlled input risk, not a secret requested by the skill itself.

Persistence & Privilege

always is false, no config paths or persistent privileges are requested. The skill can be invoked autonomously (platform default), which is expected for user-invocable instruction-only skills and is not by itself a red flag here.

Assessment

This skill appears coherent and template-driven. Before using: (1) do not paste confidential credentials or PII into the input — only provide the minimum policy text needed; (2) confirm your platform's data-handling and storage policies if you will upload internal documents; (3) treat the outputs as operational checklists, not legal advice — have legal/compliance review any formal statements; (4) verify the 'where to find it' references point to your actual storage locations (avoid exposing internal network paths in shared outputs). If you need to preserve secrecy, redact sensitive details before pasting them into the agent.

PURPOSE

Produce “show me” readiness materials: today’s checklist, an evidence index, and a gaps register aligned to operator-licence sensitivity and audit expectations.

WHEN TO USE

• “Prep me for a DVSA visit and give me a checklist for today.”
• “Create a customer audit response pack for [CUSTOMER] and list gaps.”
• “Build an evidence index for operator licence compliance.”
• “What should we have ready to show an auditor today?”

DO NOT USE WHEN…

• The request is generic compliance chat with no artefact needed.
• Pure operations/customer service requests (routes/pricing/performance) not compliance-led.

INPUTS

• REQUIRED:
  • Audit context (DVSA visit / TC inquiry readiness / customer audit) and date
  • Scope: which depot/operating centre/fleet, and period (e.g., last 28/90 days)
• OPTIONAL:
  • Your internal SOPs/policies (paste text) and retention rules
  • Prior audit findings/actions
• EXAMPLES:
  • “DVSA site visit today at Depot X; need show-me checklist and evidence index.”

OUTPUTS

• dvsa-visit-today-checklist.md
• audit-evidence-index.md (Excel-ready table)
• gaps-register.md
• Success criteria:
  • Practical, checkable items
  • Clear “where to find it” references
  • Highlights operator licence sensitivities (without legal claims beyond your policy text)

WORKFLOW

1. Confirm audit type and scope.
   • IF missing → STOP AND ASK THE USER for audit type, depot/fleet, and time period.
2. Generate today’s “show me” checklist using assets/dvsa-visit-today-checklist-template.md.
3. Build an evidence index (what, where stored, owner, retention, last updated) using assets/audit-evidence-index-template.md.
4. Identify likely gaps:
   • Mark unknowns as “Gap – confirm source/owner”.
   • Output gaps-register.md via assets/gaps-register-template.md.
5. Operator licence sensitivity:
   • Add a short section referencing references/operator-licence-sensitivity-placeholders.md and map to your internal policies.
6. If the user wants edits to existing files → ASK FIRST.

OUTPUT FORMAT

# dvsa-visit-today-checklist.md
Audit type:
Scope:
Date:

## Immediate readiness (today)
- …

## Documents to pull (and where)
- …

## People/process readiness (“show me”)
- …

## Known risks / sensitivities
- …

SAFETY & EDGE CASES

• Don’t invent retention periods or legal duties; ask for internal policy text if needed.
• If asked for “is this legal?”, stop and request the precise records and desired output artefact.

EXAMPLES

• Input: “DVSA visit today”
  • Output: checklist + evidence index + gaps register for rapid action